# Fast\_pattern field

**URL:** <https://forum.suricata.io/t/fast-pattern-field/6336>\
**Category:** Rules\
**Tags:** rules\
**Created:** [May 23, 2026, 8:21am UTC](https://forum.suricata.io/t/fast-pattern-field/6336 "2026-05-23T08:21:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![user555](https://avatars.discourse-cdn.com/v4/letter/u/8c91f0/32.png) [@user555](https://forum.suricata.io/u/user555)\
**Post date:** [May 23, 2026, 8:21am UTC](https://forum.suricata.io/t/fast-pattern-field/6336/1 "2026-05-23T08:21:30Z")

</div>

**Good afternoon, dear colleagues. Please explain why some signatures do not contain an explicitly specified fast\_pattern field?**

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [May 23, 2026, 5:31pm UTC](https://forum.suricata.io/t/fast-pattern-field/6336/2 "2026-05-23T17:31:32Z")

</div>

Suricata will autoselect a pattern. The keyword is to have the rule write decide which pattern will be used explicitly.

---

<div class="post-metadata">

**Author:** ![user555](https://avatars.discourse-cdn.com/v4/letter/u/8c91f0/32.png) [@user555](https://forum.suricata.io/u/user555)\
**Post date:** [May 23, 2026, 8:29pm UTC](https://forum.suricata.io/t/fast-pattern-field/6336/3 "2026-05-23T20:29:48Z")

</div>

Thanks for the tip. I’ve already studied the heuristic fast-pattern selection algorithm. My experience shows that heuristic algorithms aren’t always effective. I’m curious why many rules don’t explicitly specify the fast-pattern. What’s the reason? One of my current goals is to develop a fast-pattern selection algorithm that chooses more efficiently.

---

<div class="post-metadata">

**Author:** ![user555](https://avatars.discourse-cdn.com/v4/letter/u/8c91f0/32.png) [@user555](https://forum.suricata.io/u/user555)\
**Post date:** [May 23, 2026, 8:56pm UTC](https://forum.suricata.io/t/fast-pattern-field/6336/4 "2026-05-23T20:56:03Z")

</div>

In my opinion, suricata is a work of art and our mission is to make it even better!

---

<div class="post-metadata">

**Author:** ![user555](https://avatars.discourse-cdn.com/v4/letter/u/8c91f0/32.png) [@user555](https://forum.suricata.io/u/user555)\
**Post date:** [May 26, 2026, 8:02pm UTC](https://forum.suricata.io/t/fast-pattern-field/6336/5 "2026-05-26T20:02:20Z")

</div>

**For example, Let’s Encrypt as a fast\_pattern might not be the best choice, in my opinion. content:“.gdn” would be better. Don’t you think? It’s shorter (better for SIMD) and appears less frequently (in my traffic).**

== Sid: 2025190 ==  
alert tls $EXTERNAL\_NET any → $HOME\_NET any (msg:“ET HUNTING Observed Let’s Encrypt Certificate for Suspicious TLD (.gdn)”; flow:established,to\_client; tls.cert\_subject; content:“.gdn”; endswith; tls.cert\_issuer; content:“Let’s Encrypt”; classtype:bad-unknown; sid:2025190; rev:3; metadata:attack\_target Client\_Endpoint, created\_at 2018\_01\_09, deployment Perimeter, confidence Medium, signature\_severity Minor, tag Description\_Generated\_By\_Proofpoint\_Nexus, updated\_at 2020\_09\_16;)  
Fast Pattern analysis:  
Fast pattern matcher: TLS certificate issuer (tls.cert\_issuer)  
Flags: None  
Fast pattern set: no  
Fast pattern only set: no  
Fast pattern chop set: no  
Original content: Let’s Encrypt  
Final content: Let’s Encrypt

== Sid: 2025190 ==  
alert tls $EXTERNAL\_NET any → $HOME\_NET any (msg:“ET HUNTING Observed Let’s Encrypt Certificate for Suspicious TLD (.gdn)”; flow:established,to\_client; tls.cert\_subject; content:“.gdn”; endswith; tls.cert\_issuer; content:“Let’s Encrypt”; classtype:bad-unknown; sid:2025190; rev:3; metadata:attack\_target Client\_Endpoint, created\_at 2018\_01\_09, deployment Perimeter, confidence Medium, signature\_severity Minor, tag Description\_Generated\_By\_Proofpoint\_Nexus, updated\_at 2020\_09\_16;)  
Rule is App-layer TX inspecting.  
App layer protocol is tls.  
Fast Pattern “Let’s Encrypt” on “TLS certificate issuer (tls.cert\_issuer)” buffer.  
No warnings for this rule.